Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

approve lacks permission control

polaris_tow

Summary

The approve function in the smart contract lacks proper access control, allowing any external address to approve tokens for the token manager. This exposes the contract to potential security risks, including unauthorized token approvals and transfers.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/CapitalPool.sol#L20-L38

Vulnerability Details

The approve function can be called by any external address without any restrictions. It directly approves tokens for the token manager by encoding and executing the APPROVE_SELECTOR. Without proper access control, this function could be exploited by malicious actors to approve tokens without the consent of the token owner, leading to potential loss of assets or control over the tokens.

/**
* @dev Approve token for token manager
* @notice only can be called by token manager
* @param tokenAddr address of token
*/
function approve(address tokenAddr) external {
address tokenManager = tadleFactory.relatedContracts(
RelatedContractLibraries.TOKEN_MANAGER
);
(bool success, ) = tokenAddr.call(
abi.encodeWithSelector(
APPROVE_SELECTOR,
tokenManager,
type(uint256).max
)
);
​
if (!success) {
revert ApproveFailed();
}
}

Impact

If left unaddressed, this vulnerability could allow unauthorized users to approve large amounts of tokens to the token manager. This could result in unauthorized transfers, manipulation of token balances, or other forms of token misuse.

Recommendations

To mitigate this vulnerability, it is recommended to implement access control in the approve function. Ensure that only the token manager or an authorized address can call this function. This can be achieved by adding a require statement that checks if the caller is the token manager:

require(msg.sender == tokenManager, "Caller is not the token manager");

This change will ensure that only the authorized entity can approve tokens, thereby securing the contract against unauthorized access and potential exploitation.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-CapitalPool-approve-missing-access-control

This is at most low severity, even though giving max approvals shouldn't be permisionless, the respective tokenManager address is retrieved from the TadleFactory contract whereby the trusted guardian role is responsible for deploying such contracts as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L68). Since the user still has to go through the PreMarkets/DeliveryPlace contracts to perform market actions, this max approval cannot be exploited.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.